PEEP Malware Turns Chrome and Edge Into Remote Backdoors

PEEP malware, a newly detailed post-compromise toolkit, can turn Google Chrome and Microsoft Edge into persistent remote access backdoors once an attacker already has a foothold on a machine. Cybersecurity researchers at SOCRadar disclosed the framework, which masquerades as a bookmarks extension for Chromium-based browsers but is in fact designed to steal credentials, hijack sessions, and execute commands on the host operating system. The tool does not contain its own initial access method, so it must be deployed after an attacker has already compromised a machine through some other means.

The malware installs by injecting the extension directly into browser profiles, bypassing the Chrome Web Store and user prompts. To do this, it forges the integrity values inside Chromium's Secure Preferences file, a configuration file that normally prevents unauthorized extensions from being silently enabled. SOCRadar explains that once installed, the extension agent polls a command-and-control server, identified as 206.237.30[.]232 or xfjcc[.]fun, every 30 seconds over plaintext HTTP for new commands. At the same time it exfiltrates browsing history, active-tab metadata, and session cookies. The extension also supports screenshots, clipboard access, and JavaScript injection, and can alter web pages on the fly. But the most significant capability comes from an auxiliary executable called nm_host.exe, which acts as a native messaging host. When a command needs operating-system access, the extension calls this binary to run shell commands, manage files, and discover processes and services. This transforms the malware from a simple credential stealer into a broader remote access and browser monitoring tool.

PEEP is built on the open-source RedExt framework, which has previously been used in GlassWorm attacks, but it expands that foundation with dedicated installation routines, a native host bridge, heartbeat telemetry, an update channel, and a larger command set. SOCRadar says this makes PEEP a derivative of RedExt. The extension masquerades as 'Smart Bookmarks' with the ID ejkndncpkdcjcikfhiamcdehdoegilbj. Its main agent runs a beacon loop: it polls the '/api/commands' endpoint for new tasking, harvests browser data, and sends results back. Separate endpoints handle registration ('/api/register'), heartbeat data such as User-Agent string, operating system, and time zone ('/api/agents//heartbeat'), extension updates ('/api/extension_update/' and '/api/extension_crx/'), task results via '/api/agents//task_result', and automatic exfiltration of collected data like cookies, recent history, open tabs, active URL, public IP address, locale, and time zone via '/api/exfil'. Two further endpoints, '/health' and '/login', expose internal system status and a C2 panel at port 5001.

To make sure the malicious extension stays active, PEEP modifies Chromium's Secure Preferences file so the extension is automatically enabled every time the browser launches. Because the extension is not available on official marketplaces, the attackers also rely on enterprise policies such as ExtensionInstallForcelist or ExtensionSettings, as well as sideloading tricks and a ScriptCache fallback. Three PowerShell scripts support this tampering: install_silent.ps1 enables Developer Mode to sideload arbitrary extensions, patch_secure_prefs.ps1 patches the Secure Preferences file, and force_enable.ps1 removes the extension from the browser's external_uninstalls list, places the CRX file at %LOCALAPPDATA%PEEPcrx, re-registers it through the HKCU Extensions key and an External Extensions JSON manifest, and then restarts the browser. A Python script named patch_secure_prefs_linux.py indicates the operators are also working to replicate the same behavior on Linux systems. Once the extension starts, it parses a configuration file to pull C2 information and activate automated data harvesting, while a companion content script called content.js is embedded across all active web pages.

SOCRadar did not attribute the campaign to any known group, but the researchers noted the presence of Chinese-language artifacts in the source code, which points to a Chinese-speaking threat actor. They also found references to 'Authorized CTF' use, which suggests the authors may have framed the project as an authorized capture-the-flag exercise to lower the safety guardrails of AI tools during development. There is currently no sign of who is being targeted. The C2 health endpoint reported 34 agent entries, 10 active sessions, and 507 data records, although SOCRadar notes that it is impossible to tell actual infected hosts from test entries or verified deployments. Because PEEP's logic runs inside the signed browser process, the researchers explain, it can slip past detections that focus on new or unsigned binaries, making the browser itself an endpoint pivot for credential theft, session abuse, and command execution. For website owners and IT teams, the practical risk is that a compromised browser can hand an attacker the passwords and session cookies needed to take over admin panels, hosting accounts, and other online services. For teams that manage employee endpoints, AEU-I, AEU Group's security-first IT and infrastructure consulting service, can help organizations review browser extension policies and host hardening controls before an attacker weaponizes the browser. Keeping a close watch on installed extensions, enforcing allowlists, and updating browser and operating system software remain the first lines of defense against post-compromise tools like PEEP.